Tenant Attribution

Or "How I found out about - Tenant Attribution - and what the heck it is..."
An email gets send from our on-premises environment (or comes to our on-premises via the hybrid servers...). Since we're using mail gateways, Exchange routes this message to the mail gateways living in the DMZ
The mail gateways do their DNS lookup, see that the mail should be routed to EOP, and establish a connection to deliver the mail (TLS secured, since this is enabled on the mail gateways!)
EOP receives the message, goes throught its rule list and delivers the message to Exchange Online
Exchange Online delivers the message to the intended recipient...